agenttesla | hxxps://www[.]mediafire[.]com/file/ig99cthrlq6j6py/Inquiry+for+Uzbekistan+Customers+pdf[.]tgz/file

Analysis

max time kernel
299s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
06-12-2023 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/ig99cthrlq6j6py/Inquiry+for+Uzbekistan+Customers+pdf.tgz/file

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6807075796:AAGtVum7iWWKSBfZLrjjy4TEY1wRVxQr1do/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

mjhdhdhd.exemjhdhdhd.exe

pid process

3720 mjhdhdhd.exe
4144 mjhdhdhd.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

mjhdhdhd.exe

description pid process target process

PID 3720 set thread context of 4144 3720 mjhdhdhd.exe mjhdhdhd.exe

pid	process
3720	mjhdhdhd.exe
4144	mjhdhdhd.exe

description	pid	process	target process
PID 3720 set thread context of 4144	3720	mjhdhdhd.exe	mjhdhdhd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "7"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "6"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3297911616-2937201660-2816093920-1000\{8604574B-6F24-4F9B-B072-373DDE409BF7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 200000001a00eebbfe23000010009bee837d4422704eb1f55393042af1e400000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 9200310000000000865742ac1000494e515549527e3100007a0009000400efbe865739ac865742ac2e000000ff5902000000030000000000000000000000000000002d01f50049006e0071007500690072007900200066006f007200200055007a00620065006b0069007300740061006e00200043007500730074006f006d006500720073002000700064006600000018000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297911616-2937201660-2816093920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemjhdhdhd.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
4024	msedge.exe
4024	msedge.exe
1984	msedge.exe
1984	msedge.exe
2472	msedge.exe
2472	msedge.exe
3240	identity_helper.exe
3240	identity_helper.exe
3196	msedge.exe
3196	msedge.exe
4848	msedge.exe
4848	msedge.exe
4144	mjhdhdhd.exe
4144	mjhdhdhd.exe
4144	mjhdhdhd.exe
4292	msedge.exe
4292	msedge.exe
4344	msedge.exe
4344	msedge.exe
3172	msedge.exe
3172	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

Processes:

msedge.exe

pid	process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

7zG.exe7zG.exemjhdhdhd.exe

description	pid	process
Token: SeRestorePrivilege	3700	7zG.exe
Token: 35	3700	7zG.exe
Token: SeSecurityPrivilege	3700	7zG.exe
Token: SeSecurityPrivilege	3700	7zG.exe
Token: SeRestorePrivilege	452	7zG.exe
Token: 35	452	7zG.exe
Token: SeSecurityPrivilege	452	7zG.exe
Token: SeSecurityPrivilege	452	7zG.exe
Token: SeDebugPrivilege	4144	mjhdhdhd.exe

Suspicious use of FindShellTrayWindow 48 IoCs

Processes:

msedge.exe7zG.exe7zG.exe

pid	process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
3700	7zG.exe
452	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4292 msedge.exe
3172 msedge.exe
3172 msedge.exe
3172 msedge.exe
2884 msedge.exe

pid	process
4292	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
2884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1984 wrote to memory of 2588	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 2588	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 3492	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 4024	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 4024	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe
PID 1984 wrote to memory of 1392	1984	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd0da3cb8,0x7ffcd0da3cc8,0x7ffcd0da3cd8
1⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/ig99cthrlq6j6py/Inquiry+for+Uzbekistan+Customers+pdf.tgz/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
2⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
2⤵
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
2⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1360 /prefetch:1
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
2⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
2⤵
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
2⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
2⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6596 /prefetch:8
2⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
2⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
2⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
2⤵
PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
2⤵
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
2⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6992 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6884 /prefetch:8
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
2⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
2⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
2⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
2⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5560 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
2⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
2⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
2⤵
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7644 /prefetch:1
2⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
2⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
2⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
2⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
2⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13728581355618083644,13444131257281395197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
2⤵
PID:3444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2856

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\" -spe -an -ai#7zMap254:134:7zEvent25536
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3700

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\" -spe -an -ai#7zMap10500:208:7zEvent13017
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:452

C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\mjhdhdhd.exe
"C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\mjhdhdhd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3720

C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\mjhdhdhd.exe
"C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\mjhdhdhd.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mjhdhdhd.exe.log

Filesize
1KB

MD5
7e1ed0055c3eaa0bbc4a29ec1ef15a6a

SHA1
765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d

SHA256
4c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce

SHA512
de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
41a11218bccdfcc7ecfeea5f7c5779ba

SHA1
b98ff4307e2f96f0346ba5752eb6e48440f46585

SHA256
7cd4e7ca53099250135a6745e5e4c22171a7ce3ce9a9492a57f360142b9172bf

SHA512
00b69f720cb5bc7ec2fdb3087d7e24f777dd7cdfbc31bf7d529f8dc7f51b9d44e50a75e2f3007a0d94ae98bd00ad3171f16d734a56d0f608009d1ff2f775d954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14fccb91-e919-4078-9e04-7131bb28aeed.tmp

Filesize
8KB

MD5
607ce3016ac40d0267e5503cff76ff47

SHA1
512859633b5b05aa4091787798877da7b2cb0603

SHA256
eeac35c919707822ddb3419ff6e260ec689e3df00c556dcf7bfe83bcf49ba4c5

SHA512
2458efa1387ce058e9624162da7e05e924fcf216c9bb5ad448a3cc563b313ecba3f84aa12ea9cbef13b17a1532a9c5720b6ba0a6e645d774c8bfc0bdbf5e8596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
186KB

MD5
9f61d7b1098e9a21920cf7abd68ca471

SHA1
c2a75ba9d5e426f34290ebda3e7b3874a4c26a50

SHA256
2c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71

SHA512
3d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
22KB

MD5
b67f26cdbdfae0c95e270270d78798d4

SHA1
34d5bc2111f5d55a16a3f3f77ee4f00cbcd9bce2

SHA256
e732bca690e89bdda37e336684dcb1a67d270d34cc64a50f7d7d7b89e5dc72ce

SHA512
7447331d313460509558708e5230704d141a9f65d467ea1e5e391ffb6e5287b9f16ffb284ec4b2c3bdd859e71af1712a9845f349fce31c2df8413e1509addc11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
69KB

MD5
c33c3755c9bc5c370e51bd72a524da35

SHA1
7b4d2ef2b5e0188562afcd4c87060a809a7d2919

SHA256
e30aeba2b555fe999989e290128024451d7b1bccd13060ce16990a39937a3113

SHA512
7c656b1f7e9806208c87b1f22d27f07f400c5bdd3fd258056a4046c7999d4f83f6c473800b09e36450eff9ff9dd86d045eedead515aeb4bdb55e9d9889e90de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
89KB

MD5
20b4214373f69aa87de9275e453f6b2d

SHA1
05d5a9980b96319015843eee1bd58c5e6673e0c2

SHA256
aa3989bee002801f726b171dcc39c806371112d0cfd4b4d1d4ae91495a419820

SHA512
c1e86e909473386b890d25d934de803f313a8d8572eb54984b97f3f9b2b88cbe2fb43a20f9c3361b53b040b3b61afb154b3ec99a60e35df8cf3563dabf335f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
1.0MB

MD5
7389b488fc919f10de2e4b3d7dc17ce2

SHA1
b2b1e5f72bbf1e6d23f41a257ea04cd6496e8ec2

SHA256
2b5305d10ee7ed5449f326f979898ed7c5f992cb76fd098af8e302de805bd583

SHA512
c14ea900eb68108889d71233a2928e6c06b7cc947e73ae72b2a677b612498dd9fb66f7a892d2a67dd070e98d70f5b755678947ff4d4284955d12d8d066b2d3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
32313e19ccddd960b6261d5597c058a7

SHA1
59dc287e32a25eebb8cf3f828802705d2f791bf6

SHA256
bc9fb5ce7f27c56135fa41ea34fd0e876568a167cd8927f8a344a3c4f9cfe217

SHA512
fda03a2b5838a7401c1099dc11a289f0117902f8405765c586787aa1fa49217a4f9ae38e189ce39638cdcb16ac4904ff62664cb48aee830f024bca5169bf5ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a7f28412f41648594cb683e3512c3be8

SHA1
23aa1e5e91e5d4004d2621c87029c45cf8350fa6

SHA256
d5cff9f7227d4db9efe17e7d46efffb1fc9eff4fd09b1d97194333d81aab2b39

SHA512
c5ba49b88085ccfe1989571ae4b428468ba3e6f813dcfdf96c2e917f23261274d9ed229c738e4c272252980932b5fb2693461c30b89751018efa2c8b57168ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5378d151a264fd42339bfbc997bf16af

SHA1
3695a3586284fe9204228a4af516d3fd9113e426

SHA256
625a0279482e95c978e1bfe00fbb68c65eef586a0741670fbf077e205b65ae35

SHA512
ed9e1e4c1e8ed3636b7795837aaecfbf84b83b9e1ab97cb622626385afea415c1a34fe151643507a407485f44aed6c5f626f5ffa98da013e29692c2b3cf08c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
185B

MD5
b69adcfb75f2916b35c51474352bb803

SHA1
c4646f34326f902dcdd824338e0e9d9ec98c1eca

SHA256
ba460330a066edf83b12d01733f71ee2e5a1d9ff657473ce6a02c1d55635d971

SHA512
6074e327f9c72839df92f70fc623773128abbe598a6af6ac65f57fdcc94b219a5718721676e5e7c982383861ae40b6cb8a9284f0fa2b0db1c05192ab89fbd36f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
76425c67e5e818d1e17805cadedc2ddf

SHA1
de8b9c278c22f0cc8219541f0eeb9d0c0c0d343f

SHA256
26d58ef792f2e5d4aff534488ece3a8a956e6cde67880ad922a25715c5599b1d

SHA512
db58bd3ddbbe37018f69147feb236b5ef4c11a3568b8f7ccf22afb4f915bf42b913f3cdf7716adbe833a6975d2dd32633d5237b2479e6c3df1336c5b5e0ec8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2c96a611524ecf20a762b7bc8a06459c

SHA1
9654036dd30843bda55c85d4c5b659fedea669eb

SHA256
b2d59077a963ba61d7034700371d94d8a314d9c7a4aa61fbe102eff28caf9f8c

SHA512
5977d06796dc4d18846d85160bdcdb270261ac6c126f81e2f8705822f33906413dea71387470d1b8d9542ee3bc3e121ec5b5b0288610789533f9f13c485368e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
55d6c269868c96cfa2da042703f8249a

SHA1
d240582550961a9a33fb5889560ac59f1d5f9861

SHA256
9a1261646e25bed609779ffc5478eb88642e249da22ae16b540de181f0162320

SHA512
dc98019eacb2b6b09b091efa0d1aa0547819491e7c44ff54655ac6d1aa7eca9b4d1346d104f032ba01289792a1a00dad881553c8978dc6a618c46eb61abaa304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
53abd1d5610c1154b118678c7320c041

SHA1
f166b54c181cc80c3f80ff282df9182f6290950f

SHA256
87835cf3c1da80667f6d487183cfb05d4941a2a65688284b3701d578291c0003

SHA512
958326eb92fbecb6805f234903f42dcee252c4749d1722f0d1ecb22701c4513d4f93fbe3775c08d903dda5eeb2c5a46e149e29c8099393496d445f65770bbc01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0ac0edbd399df1dffb474dd3c216fcb7

SHA1
27aa4ebdb8a9656a981f678935b0787a85d4d42a

SHA256
40b71b9c7d16dda705b0f2c0d9048452aa1522919dfd26c2fddcb770ca686971

SHA512
820d000b3917206d913cf1489003bc13d244822d4f3557e8cb189716793fbe56ef2958467863314733b5b170cccc230a4a5fcb25ee8608a03e1fa99d64d147ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4eaf7e156e846a63630f27164663cab8

SHA1
aade3e1f46e2d74ec25fa8d3cc8e4099e5af2fc2

SHA256
340c7a4dc67e3df3a71ba1c07eb9ea5315dbeb4d661cd9a121b905faec55a2fc

SHA512
3fe61624c8dc8d8eceb680ac71b6e4344d3ceaa92be27f1838c15180cbc6926276520c01c8fd7b0782882fe0a188df51a4c3747cd19a3c507d2f237c9e9c94ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7be04c31e7bfa5c89dc89069e6afec03

SHA1
4cfdd840e1d0b84b1ff81003106fefab5e2fdd07

SHA256
22574dd3cfc230c58e44e803a8cc94201137eff236cab1e95cf6fd20ff4ef454

SHA512
7cb2d65b9d2df815b2d7f92e75007d1eb00da706b1bfef37a3ffdf8b5852334902d53bac5f2f339251251142e47fcd52866129d8d6a8eac29067edbf4ba35b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1aaa43db2cbfa00e9abed30055bdc0c8

SHA1
11710f2e53720b24dde2393d3f825046d3b95d78

SHA256
f366b522670fbbe448bcac4eb7314b2afdfc859754806bcbffc9db18d4f16bd7

SHA512
a0f74da37c30a739983849512b4c481e92af7ba29383d8bdd1741f2096019f1c63aed1d3effd290e930546cff27197c837e12c6eefbfba7d0c720cbbd9dd0d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b9837008c6827931c7fdfc51693666f

SHA1
f6dc06eb3a295ac9a5bd45db2f64c5154ddf7459

SHA256
66f3b435d142d865aea1e51a46fcefa63bea393109f9b5b10a0cd64839ed1626

SHA512
1a13884b9a0a943fff26284bebe1cbc2f9c24e4f72d890aa60b170138420e2cfd29b24dd8e2be2485cd6a39a33211e84c8947787fa23453fac36eadbe0d3d2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
bd08c083680147ec2bc4193845a248d8

SHA1
8b601791e48d39353ebf2b048b6f5554e8363293

SHA256
25bd3ea723d11f7d1772c3dbcf2bde3e9a778010d9b4d84d7db10ca88c0734c1

SHA512
b0fd8f25fc20d04277f6063a4c8875c19fcd63dbc4513fdd9d50b08817dea5c7498c46a53bc8b2dce1b94d25a9c86a2ca8ea22c354fcda766af8bb2ab33c175a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
2400963bbabbb02bc160d3776b59b742

SHA1
7b42d62fb4e0a9214e97bb68a54d62930c0f093b

SHA256
dcec23e5ec5c0607d4b12551ad345e4ad72b4bf3d5f513641bd99a72f0d4b838

SHA512
8c8af8ed72df11abd6fbebebc406345d85ea5f79013b7270a782afc65108ec291ca96daf478853ab8932383056b7708324b1abc2b836f0d367de535e46f5bf98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
98d66f67b3c174ba6126cb7f07ef3002

SHA1
08113ce7ed4e2c43fe4dd230e9493bc88a8de740

SHA256
5878e34aed83b4ed58a3bf1280e4d5efba6ed0736043c16cc4b6ab912e30b40e

SHA512
199a5c7bb16285a4d96ccc662546ddb83fcd00506b0f0ed1f2b8efa4b3dce1ef838b7be71d9dfbcff6acdf36c5271ef66e6a30c8a5028f8a2da3570ab36f62b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593668.TMP

Filesize
48B

MD5
1c40fadd639f3ead1630bb78a54d840c

SHA1
fd9e084716c183ce6b466a353d87aa19f1dbbd30

SHA256
5bbb86fa48e0746bafffec296e2a585b218fc3953b7eb01202960a1fca0af62e

SHA512
3a059a4efbd34b6ac565146cae63c333a8317eeb9ce5ea2093795ae8a159f9709394bf76ad61b9bcf6c89dc816427771744b24f7ea3cea3015b225b38c3ce464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90064659b07feada0d61c2606d411584

SHA1
4cddb618be2e634995416f572c8b949b1a20f640

SHA256
12979f13dad4d867fb05720d74b4108a541107a4991bdcb61a692fdcab5bd7f8

SHA512
78ef099c60c761539a141bd6392761ab8a42708eb3858f43389af42869c9534c10b2b1c48eb7709804a085afa8c6d9afaa434a37c3c23a8ac7befdfe0f9e4e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
28d85d6eb3ac5d24e85aca9e911c58ea

SHA1
1fb648153414a0864104e5cd814b7c3b6ba778a5

SHA256
82405dd7531784a9b4314cdf8a574226774e002dcac3ad83b1adbc77ee7c88dc

SHA512
5e6ed2257ad4a2a60c903038661d960d26b96dd815d0c8b16048fecb453d1acc00a78407ed91c0dd0816d06fee264138c2f40d5d1d4c402647c4c9368de403e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f93092a65447b42a1f637901a732010

SHA1
1c478e3b78e8c021758ff890246fe6037073f08c

SHA256
b44ec7a9c9e5f4d648f3a14b68b6f10aea1a1bae40c596af10c2277be716d30b

SHA512
989cac1d0d140c0217d5a63f66279ff7e692e65c11b1a0ac2dab17a5f27feb68fa534fe70e0eaa7a787427d97450d3a19de94c21c6d7b30f209d5c14dac16710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c54ee8c5c3c425702de6ef11fe0230c3

SHA1
a6f344fa68fb2f62faf3c573e7dac8c9f1fad2fc

SHA256
7e7d8448194f8ce1daabbc1635c9d15076c6e20b95a5e2df3e5561314d523ef9

SHA512
accc597420e2eae7163233da6b99f94e10e7fe2d080add56fbc9c1fa49288e9a064fb7467163c83f49930b39bd3081e2b08b35acd1062a43705da74aed229e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9b85a6b1a7e0094995b8b9a28474f584

SHA1
408253a14b794c9c858ebbb5ca7322e54926b28a

SHA256
e42c77aabfe942da594fcc05590f8f363bf3b17913bcac17f02e38a88cb074b0

SHA512
a2c57b7c4a5864213005218011cff6027f876ab5ebdcdb9f2fdb355158d6ef31cd447365f323ab0d3dcaa83a50edccdc1635df241845085614c6ac698f597e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e58c16aaf7a5dfae88b8872113e62150

SHA1
69861be3cbc119f29eeadf0e938db32a620a0c4d

SHA256
f2c64a9fd84d0ebaaf4f128deda3e84f46f3c3cdca514ca9767aee3b22ee9ffc

SHA512
f49f9d014ac5df749bf87c99aa676b6fc3411732b01902112d321b33f1117f996541ed7d288ade2e451e36790967531b62d24eb73c0228fe8fdedc4544af2466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18c6f159065d967fd5c33908868d4937

SHA1
8c924ed4e536344fb0daaace5b8269d147eb8db2

SHA256
aba1e98dfa39c4524cbf4e62749170e9cdb15a80e83e6086502e0b33f77f0156

SHA512
8ab1b6b6a9afa014e4a9d00975ab123748a62fb3f446a6f8f6f7ca160781c48f42ae0ff4bc15f420537d662008a51463f5092bca12f826c4c519f2d9a376b2c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b54bcc1dbeb1b5de2e2b3b74e8c29896

SHA1
518e47a39ab9ef9c96d2b91f04b41c6ccc150cd4

SHA256
407cc63f4260cf124db9b0510a9d6d5934388da46aa9d3568bdd192047c8c52d

SHA512
58ab3a31150f965e537be087260aba24ee0615a198f714c73e7541112fe275531a61824a7700291361ed81a8faa57a70bed59a42f60393973244a062d330bd33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb277b489b1cefe878b46a32098856b8

SHA1
eec690f8552c2ebedb0b2cdeca4fcf4d85acf972

SHA256
0d083c6f102e76eafdc4dcc24f1b59111b5bd75726cab6c93803f0ab9f38cbac

SHA512
28c8a7e924b1ada68f8fb7ef58a76ce4797436057647e0569d83750de541518bf8bc0bf1b2b48e501024c394c15b00340ad4401de9c56cc0451b904537729342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1e874b805887b170c42556a7eedc77a0

SHA1
b655fa12361d589c439e4065cf478a5d5389926c

SHA256
8ed084f0f7f5b8e491b71770f564459dc7a431875f436e8a4396e2be42be2883

SHA512
8f0c9c9e497ad2a16cf21f49000286641866f0e70cfa51d63cca903a828e0feba6fb6ce52e94b464bae5145170380abf0967912c3c8a50d9524793eac37fd8ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e7cb6f55182e0f519b054ca1669a96f

SHA1
20050c72ab1ca9cd7cf2364694543a87a3b94d35

SHA256
ef9ad302ae49e5392408fb2f0f0b0587191ee2ca1fe7cf81e9237ff468a133d7

SHA512
2991453fbb2a792cd6c49ed2f66ff2e6ccb54b5d97d44a8c8a956f6ee54a98315cd58fb649d56096aead4ae9eef95723c91549e9a53c6a9bc03d5052d417e2fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f5615a687ee725d2bca76dc619911957

SHA1
e75442a26c4e423d79a355d57c966e9c88bd2e16

SHA256
7f1353041228ed7a61cf89f76894e827a73ce66bd5571ca70798455bf200637b

SHA512
07c0c70355fe6b36ef543f186bb18b5bf7da5644751ffb3e790acf5954253d41a078521601e88a03223bc19836a2a92110cf18656ea047a99cf8bed7ba180417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590a18.TMP

Filesize
37B

MD5
661760f65468e15dd28c1fd21fb55e6d

SHA1
207638003735c9b113b1f47bb043cdcdbf4b0b5f

SHA256
0a5f22651f8fe6179e924a10a444b7c394c56e1ed6015d3fc336198252984c0e

SHA512
6454c5f69a2d7d7f0df4f066f539561c365bb6b14c466f282a99bf1116b72d757bef0bf03a0e0c68a7538a02a993fc070c52133ca2162c8496017053194f441c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
91d3bc8ef38d61106d1b045399658a10

SHA1
aed130ec3ad4d75ebf54c0af57191af7c81d2725

SHA256
87767074373c366721d7e1c4e52861897a42126954516adefb9cb0166e6b944e

SHA512
f8bc357d7a119fca9ad8328bfcc5bbe71f79688ff9f730fea49252e6c0bd74c8c8167b1d7df0962ebab2a40733f1387c1a0abe910be32391ba9ac2e199b50e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f942e16a8c4691e7bd5891eecdc652e6

SHA1
850fa3a283c20be550cc164b6ac8e95bffe3afa4

SHA256
b8585caa4e09e87355af1b949d1fc0a61600a106c6b604d637ef2b6a52babd55

SHA512
4422dff2dcd7eaf31663dbb9a89cc7ffb1aa51191dee60a6cc2d55975ed4802a50c348020cb23c85e4c47319d7444a346ad8158d589cdf47a306259b7554d1c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1578c236d159e2d4d645eeea4994b05c

SHA1
93ec0d151717f70c00a7bdaadfdecf71f552ce13

SHA256
d88541d49504875436d5dd184c7b0f62f59ec2b99e662fed77a1696a02780eba

SHA512
6e23d9cc64a8d7f3dcd0ce46cf27b77a18000df93fac8bac2ef4868db2b340b8dbcaf83f9320e7979d8219d92ab4e4e5b8bf9e24657dc3a61504d0382ad8d7c5

Download Submit
C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf.tgz

Filesize
1.6MB

MD5
4fcb263f795d89eea2abe71abe89aacf

SHA1
20c46512d99aa98a409f8840e368e9d0df3c4d9c

SHA256
be2b71e2595cbbf36aa838c5d232cb872630345662f3a6c804248a2ef673d811

SHA512
6644409d703113e4aa014354f1a64e883f3c59e9b49319d4da5fd30667dd9d2cb983710dedd37a8b52fb1ef4888bb8a6cbb1bed9367afa3de16278677bb4fddc

Download Submit
C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf.tar

Filesize
906.0MB

MD5
8e0715c6deecc8538e14203079bd5bee

SHA1
d538441f1a4d7c9234139b421c9cd72dc6ab43a4

SHA256
435137152814e70ce0938fc3d6a735a17ca8ce76ccb5d1cc2775eea61ce6d1be

SHA512
2d3c75f1f21dde3e9ed9db02395db8502daacc967646cee998797532aae5cc864b9a80419ea51398b43d4e09c54ed94f01c3a2b45d63cbe3df083ea3e1bf8572

Download Submit
C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\mjhdhdhd.exe

Filesize
906.0MB

MD5
17be580335e696365f0bc158b8bd08c3

SHA1
88be59524b220aaa905e83511ec5947b40fab847

SHA256
4e3214951ed1e5383a86ec376ed10ff2f4ea5fd957d07771d3a22fa2bb4e55d7

SHA512
5c5cd87a282caff52354e16638fd202a4e4e331edc112fd9d811a3e64b2a0bda9e67902b3bbf1fd5ca0877a55e17188104a108dac570687ba4fb7ed6029d44ba

Download Submit
C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\mjhdhdhd.exe

Filesize
906.0MB

MD5
17be580335e696365f0bc158b8bd08c3

SHA1
88be59524b220aaa905e83511ec5947b40fab847

SHA256
4e3214951ed1e5383a86ec376ed10ff2f4ea5fd957d07771d3a22fa2bb4e55d7

SHA512
5c5cd87a282caff52354e16638fd202a4e4e331edc112fd9d811a3e64b2a0bda9e67902b3bbf1fd5ca0877a55e17188104a108dac570687ba4fb7ed6029d44ba

Download Submit
C:\Users\Admin\Downloads\Inquiry for Uzbekistan Customers pdf\Inquiry for Uzbekistan Customers pdf\mjhdhdhd.exe

Filesize
906.0MB

MD5
17be580335e696365f0bc158b8bd08c3

SHA1
88be59524b220aaa905e83511ec5947b40fab847

SHA256
4e3214951ed1e5383a86ec376ed10ff2f4ea5fd957d07771d3a22fa2bb4e55d7

SHA512
5c5cd87a282caff52354e16638fd202a4e4e331edc112fd9d811a3e64b2a0bda9e67902b3bbf1fd5ca0877a55e17188104a108dac570687ba4fb7ed6029d44ba

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 600703.crdownload

Filesize
1.6MB

MD5
4fcb263f795d89eea2abe71abe89aacf

SHA1
20c46512d99aa98a409f8840e368e9d0df3c4d9c

SHA256
be2b71e2595cbbf36aa838c5d232cb872630345662f3a6c804248a2ef673d811

SHA512
6644409d703113e4aa014354f1a64e883f3c59e9b49319d4da5fd30667dd9d2cb983710dedd37a8b52fb1ef4888bb8a6cbb1bed9367afa3de16278677bb4fddc

Download Submit
\??\pipe\LOCAL\crashpad_1984_NCXCHCPKXROAEBGO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3720-125-0x0000000000D10000-0x0000000000DCE000-memory.dmp

Filesize
760KB

Download
memory/3720-126-0x00000000749B0000-0x0000000075161000-memory.dmp

Filesize
7.7MB

Download
memory/3720-157-0x00000000749B0000-0x0000000075161000-memory.dmp

Filesize
7.7MB

Download
memory/3720-150-0x00000000081C0000-0x000000000825C000-memory.dmp

Filesize
624KB

Download
memory/3720-127-0x0000000005E50000-0x00000000063F6000-memory.dmp

Filesize
5.6MB

Download
memory/3720-129-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/3720-131-0x0000000005E30000-0x0000000005E4A000-memory.dmp

Filesize
104KB

Download
memory/3720-149-0x0000000006EE0000-0x0000000006F5A000-memory.dmp

Filesize
488KB

Download
memory/3720-148-0x0000000006A20000-0x0000000006A2A000-memory.dmp

Filesize
40KB

Download
memory/3720-147-0x0000000006A10000-0x0000000006A18000-memory.dmp

Filesize
32KB

Download
memory/3720-128-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/3720-130-0x0000000005870000-0x000000000587A000-memory.dmp

Filesize
40KB

Download
memory/4144-300-0x00000000749B0000-0x0000000075161000-memory.dmp

Filesize
7.7MB

Download
memory/4144-156-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download
memory/4144-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4144-155-0x00000000749B0000-0x0000000075161000-memory.dmp

Filesize
7.7MB

Download
memory/4144-158-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/4144-168-0x0000000006680000-0x00000000066D0000-memory.dmp

Filesize
320KB

Download
memory/4144-314-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download